CVE-2025-46618: JetBrains TeamCity XSS Vulnerability

CVE-2025-46618 Overview

CVE-2025-46618 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity, a continuous integration and deployment server. The flaw affects versions before 2025.03.1 and resides in the Data Directory tab of the administration interface. Attackers with access to inject content into the Data Directory can persist malicious script payloads that execute in the browsers of administrators who view the affected page. The issue is tracked under CWE-79 and referenced in the JetBrains Security Issues Fixed advisory.

Critical Impact
Successful exploitation allows session hijacking, credential theft, or execution of privileged actions in the context of a TeamCity administrator, compromising the build and deployment pipeline.

Affected Products

JetBrains TeamCity versions prior to 2025.03.1
Self-hosted TeamCity build servers exposing the administrative Data Directory tab
CI/CD environments where multiple users have access to server configuration surfaces

Discovery Timeline

2025-04-25 - CVE-2025-46618 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46618

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the TeamCity web interface, specifically on the Data Directory administration tab. TeamCity fails to sufficiently encode or sanitize user-influenced content rendered on this tab. Because the payload is stored server-side, it executes on every subsequent visit by any authorized user viewing the tab.

Stored XSS on a CI/CD administration page is especially impactful. TeamCity administrators typically have permission to modify build configurations, view secrets, and deploy code. Script execution in that context can pivot into supply chain compromise. The vulnerability requires user interaction, since the victim must load the affected tab, but no authentication is required to trigger the injection path in the specific conditions covered by the advisory.

JetBrains has categorized the issue under CWE-79 (Improper Neutralization of Input During Web Page Generation). The EPSS probability is 28.742% at the 97.936 percentile, indicating comparatively elevated interest in exploitation modeling relative to the general CVE population.

Root Cause

The root cause is missing or incomplete output encoding when TeamCity renders data associated with the Data Directory tab. Content that should be treated as opaque text is emitted into the HTML response without contextual escaping, allowing an attacker-controlled string containing <script> or event-handler attributes to be interpreted as executable markup by the browser.

Attack Vector

The attack vector is network-based through the TeamCity web UI. An attacker introduces a crafted payload into a field or artifact that is later rendered on the Data Directory tab. When an administrator opens the tab, the browser parses and executes the injected script under the TeamCity origin. The attacker can then exfiltrate session cookies, issue authenticated API calls, or modify build definitions. No exploitation code or public proof of concept is currently referenced in the vendor advisory.

Detection Methods for CVE-2025-46618

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event attributes (onerror, onload) appearing in stored TeamCity configuration data
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading the Data Directory tab
New or modified TeamCity user tokens, API keys, or administrator accounts created without an authorized change ticket

Detection Strategies

Review TeamCity audit logs for edits to Data Directory metadata by non-administrative or anomalous accounts
Inspect the rendered HTML of the Data Directory tab for markup that does not match expected configuration values
Correlate administrator web sessions with subsequent API activity to detect scripted actions inconsistent with human workflow patterns

Monitoring Recommendations

Enable and centralize TeamCity server access logs and application audit logs in a SIEM for retention and search
Alert on creation of new administrator-level tokens or permission grants outside change windows
Monitor egress traffic from workstations used by CI/CD administrators for unexpected connections to external hosts

How to Mitigate CVE-2025-46618

Immediate Actions Required

Upgrade TeamCity to version 2025.03.1 or later, which contains the vendor fix
Rotate TeamCity administrator credentials and API tokens if the server was exposed to untrusted users before patching
Audit stored configuration data, including the Data Directory tab, for injected HTML or script content and remove any suspicious values

Patch Information

JetBrains addressed CVE-2025-46618 in TeamCity 2025.03.1. Refer to the JetBrains Security Issues Fixed page for the authoritative advisory and release notes. Apply the upgrade through the standard TeamCity update workflow and validate the version after restart.

Workarounds

Restrict access to the TeamCity administrative interface to a limited set of trusted network sources using firewall or reverse proxy rules
Enforce a strict Content Security Policy at the reverse proxy layer to reduce the impact of injected scripts until the patch is deployed
Limit the number of accounts with permission to modify configuration fields that render on the Data Directory tab

bash

# Verify installed TeamCity version after upgrade
curl -s -u <admin>:<token> https://teamcity.example.com/app/rest/server | grep -i version